This vulnerability (CVE-2026-45486) is a use-after-free issue in Microsoft Office Word component of Microsoft 365 Apps for Enterprise. It enables an unauthorized attacker to execute arbitrary code locally by exploiting improper memory handling. The CVSS 3.1 base score is 7.8, indicating high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits are reported in the wild at this time.

Successful exploitation allows local code execution by an unauthorized attacker, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. This can result in execution of arbitrary code with the privileges of the user running the application.

An official fix is available from Microsoft. Users and administrators should apply the update for Microsoft 365 Apps for Enterprise version 16.0.1 or later as provided in the Microsoft security update guide. Since this is a cloud-managed service, Microsoft handles remediation server-side; verify with the vendor advisory for current status and ensure client applications are updated accordingly.